IN THE CLAIMS: 

The text of all pending claims, (including withdrawn claims) is set forth below. Cancelled 
and not entered claims are indicated with claim number and status only. The claims are listed 
befow for the convenience of the Examiner. No changes have been made. The status of each 
claim is indicated with one of (original), (currently amended), (cancelled), (withdrawn), (new), 
(previously presented), or (not entered). 

p| ease AMEND claim 47 in accordance with the following: 

1. (previously presented) A system for managing information comprising: 
a communication request monitor unit which monitors a communication request; 
a management unit which selects a countermeasure based upon information notified 
from the communication request monitor unit; 

a performing unit which performs a countermeasure in response to an instruction from 

the management unit, 

wherein said management unit comprises: 

a database which manages a notification content from the communication 
request monitor unit and the countermeasure that the performing unit performs such that the 
notification content and the countermeasure correspond to each other, and 

a selection unit which selects the countermeasure from various angles based 
upon the database and mounting information, operation information, and/or security information 
to be performed; 

an information collection unit which collects information related to a kind, a 
content, an order, and a time interval of two or more communications in a progress process of an 
attack event or a leakage event, such that the information is collected through an attack caused 
by induction through a vulnerability manifested in a decoy server, so that the collected 
information is analyzed to be recognized as an attack pattern to be used to predict a future 

attack which may occur; and 

a reflection unit which reflects the information collected and regulated by the 
information collection unit upon the database, to thereby predict a possible attack event or a 
leakage event in advance, and to avoid the predicted attack event or leakage event before 
execution of the predicted attack event or leakage event, wherein the information notified by the 
communication request monitor unit and/or countermeasure selected by the management unit 
are weighted. 
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Claims 2-3 (cancelled) 

4. (previously presented) The system according to claim 1, wherein based upon which 
of the mounting information, the operation management information and/or the security 
information a countermeasure is selected can be setting-changed according to the selection of a 
user, 

5. (original) The system according to claim 1 , wherein the communication request 
monitor unit, management unit, and the performing unit are provided in plurality, 

6. (original) The system according to claim 5, wherein the communication request 
monitor units, management units, and the performing units cooperate with each other between 
the same type or different types thereof to exchange information, 

7. (cancelled) 

8. (previously presented) The system according to claim 1 , wherein a weight coefficient 
for the weighting can be arbitrarily set by a user. 

9. (previously presented)The system according to claim 1 , wherein a weight coefficient 
for the weighting is set based upon the mounting information, operation management 
information and/or security information, 

10. (original) The system according to claim 1, wherein the database holds information 
notified by the communication request monitor unit in time series, and the selection unit selects a 
countermeasure based upon the time series information stored in the database, 

11 (original) The system according to claim 5, further comprising a site map formation 
unit which forms a site map representing a spatiai arrangement of a website based upon the 
information notified by the plural communication request monitor unit. 

12. (previously presented) The system according to claiml, further comprising a site 
map formation unit which forms a site map representing a spatial arrangement of a website 
based upon the information notified by the plural communication request monitor unit. 
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13. (original) The system according to claim 10, further comprising a site map formation 
unit which forms a site map representing a spatial arrangement of a website based upon the 
information notified by the plural communication request monitor unit. 

14. (previously presented) The system according to claim 5, further comprising a 
monitor condition notification unit which notifies the communication request monitor unit of the 
kind and/or time of a communication to be a monitor object based upon a site map formed by a 
site map formation unit. 

1 5. (previously presented) The system according to claim 1 , further comprising a 
monitor condition notification unit which notifies the communication request monitor unit of the 
kind and/or time of a communication to be a monitor object based upon a site map formed by a 
site map formation unit. 

16. (original) The system according to claim 10, further comprising a monitor condition 
notification unit which notifies the communication request monitor unit of the kind and/or time of 
a communication to be a monitor object based upon the a site map formed by the site map 
formation unit. 

17. (original) The system according to claim 1 , wherein the management unit gives a 
request to a website existing in a network and automatically updates the database based upon 
information replied in response to the request. 

18. (previously presented) The system according to claim 17, wherein the request is 
performed at a user's suggestion. 

19. (original)The system according to claim 1 , wherein the management unit 
automatically updates the database based upon information automatically transmitted from a 
website existing in a network. 

20. (previously presented) The system according to claim 19, wherein the information 
automatically transmitted from a website existing in a network is taken in the database in 
response to a request of a user. 
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21. (previously presented) The system according to claim 1, further comprising: 
a vulnerability present unit which provides vulnerability of the system; and 

the information collection unit which collects information related to an attack the 
vulnerability presented by the vulnerability present unit. 

22. (original) The system according to claim 1 , further comprising an investigation unit 
investigating an outgoing source of a communication content and a determination unit which 
determines whether or not a website is made a stepping-stone by an ill-intentioned person 
based upon an investigation result by the investigation unit. 

23. (original) The system according to claim 1 , further comprising a decoy unit leading a 
communication to a location different from an attack object to avoid an attack. 

24. (previously presented) A method of managing information comprising: 
monitoring a communication request by a communication request monitor unit; 
selecting, via a management unit, a countermeasure from various angles based upon a 

database and mounting information, operation management information, and/or security 
information, wherein the database manages a notification content notified by the communication 
request monitor step and a countermeasure to be performed such that the notification content 
and the countermeasure correspond to each other; and 

performing, via a performing unit, the countermeasure selected in response to an 
instruction from the management unit; 

collecting information related to a kind, a content, an order, and a time interval of two or 
more communications in a progress process of an attack event or a leakage event, such that the 
information is collected through an attack caused by induction through a vulnerability manifested 
in a decoy server, so that the collected information is analyzed to be recognized as an attack 
pattern to be used to predict a future attack which may occur; and 

reflecting the information collected and regulated by the information collection step upon 
the database, to thereby predict a possible attack event or a leakage event in advance, and to 
avoid the predicted attack event or leakage event before execution of the predicted attack event 
or leakage event, wherein the information notified by the communication request monitor unit 
and/or countermeasure selected by the management unit are weighted. 



5 



Claims 25-26 (cancelled) 

27. (previously presented) The method according to claim 24, wherein based upon 
which of the mounting information, the operation management information and/or the security 
information a countermeasure is selected and can be setting-changed according to the selection 
of a user 

28. (original) The method according to claim 24, wherein the communication request 
monitor unit, management unit, and the performing unit are provided in plurality. 

29. (original) The method according to claim 28, wherein the respective plurality of 
communication request monitor units, management units, and performing units cooperate with 
each other between the same type or different types thereof to exchange information. 

30. (cancelled) 

31 . (original) The method according to claim 30, wherein a weight coefficient for the 
weighting can be arbitrarily set by a user 

32. (previously presented) The method according to claim 24, wherein a weight 
coefficient for the weighting is set based upon the mounting information, operation management 
information and/or security information. 

33. (previously presented) The method according to claim 24, wherein the database 
holds information notified by the communication request monitor unit in time series, and a 
countermeasure is selected based upon the time series information stored in the database. 

34. (previously presented) The method according to claim 28, further comprising 
forming a site map representing a spatial arrangement of a website based upon the information 
notified by the communication request monitor units. 

35. (previously presented) The method according to claim 24, further comprising 
forming a site map representing a spatial arrangement of a website based upon the information 
notified by the communication request monitor units. 
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36. (previously presented) The method according to claim 33, further comprising 
forming a site map representing a spatial arrangement of a website based upon the information 
notified by the communication request monitor units. 

37. (previously presented) The method according to claim 28, further comprising 
notifying the communication request monitor units of the kind and/or time of a communication to 
be a monitor object based upon a site map formed, 

38. (previously presented) The method according to claim 24, further comprising a 
notifying the communication request monitor units of the kind and/or time of a communication to 
be a monitor object based upon a site map formed. 

39. (previously presented) The method according to claim 33, further comprising a 
notifying the communication request monitor units of the kind and/or time of a communication to 
be a monitor object based upon a site map formed. 

40. (original) The method according to claim 24, wherein the management unit gives a 
request to a website existing in a network and automatically updates the database based upon 
information replied in response to the request. 

41 . (original) The method according to claim 40, wherein the request is performed in 
response to a request of a user. 

42. (original) The method according to claim 24, wherein the management unit 
automatically updates the database based upon information automatically transmitted from a 
website existing in a network. 

43. (original) The method according to claim 42, wherein the database is automatically 
update based on the information transmitted from a website existing in a network in response to 
a request of a user. 



44. (previously presented) The method according to claim 24, further comprising 
providing vulnerability of the system; and the information collection step collecting information 
related to an attack against the vulnerability provided. 

45. (previously presented) The method according to claim 24, further comprising 
investigating an outgoing source of a communication content and determining whether a website 
is made a stepping-stone by an ill-intentioned person based upon an investigation result. 

46. (original) The method according to claim 24, further comprising a decoy unit leading 
a communication to a location different from an attack object to avoid an attack, 

47. (currently amended) A computer readable medium comprising read bv a computer 
and encoded with a program that when executed bv the computer causes the computer to 
perform a method- p e rform e d by a computer, th e m e thod -comprising: 

monitoring communication requests; 

outputting a notification in case of an abnormality; 

selecting a countermeasure from various angles based upon a database and mounting 
information, operation management information, and/or security information, wherein the 
database manages a content of the notification and a corresponding countermeasure; 

performing a countermeasure against the abnormality based on the selected 
countermeasure; 

collecting information related to a kind, a content, an order, and a time interval of two or 
more communications in a proceeding process of an attack event or a leakage event, such that 
the information is collected through an attack caused by induction through a vulnerability 
manifested in a decoy server, so that the collected information is analyzed to be recognized as 
an attack pattern to be used to predict a future attack which may occur; and 

reflecting the information collected and regulated by the information collected upon the 
database, to thereby predict a possible attack event or a leakage event in advance, and to avoid 
the predicted attack event or leakage event before execution of the predicted attack event or 
leakage event. 

48. (Cancelled) 
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